A Systematic Review of Machine Learning Methods for Network Intrusion Detection: Performance, Datasets, and Cybersecurity Implementation Challenges

The increasing frequency and complexity of cyberattacks have highlighted the need for effective Network Intrusion Detection Systems (NIDS). Machine learning (ML) has emerged as a promising approach for identifying malicious network traffic and detecting anomalous activities. However, differences in algorithms, datasets, evaluation metrics, and experimental settings make it difficult to compare existing approaches and determine their suitability for real-world deployment. This study aims to systematically review machine learning methods for network intrusion detection, with particular emphasis on model performance, dataset characteristics, evaluation practices, and implementation challenges. The review adopts a Systematic Literature Review (SLR) approach guided by the PRISMA 2020 reporting framework. The analysis focuses on machine learning and deep learning techniques, commonly used benchmark datasets, and evaluation metrics such as accuracy, precision, recall, F1-score, and false-positive rate. The reviewed literature indicates that ensemble learning and hybrid models demonstrate promising detection performance on several benchmark datasets, while deep learning approaches provide opportunities to identify complex traffic patterns and network anomalies. Nevertheless, high performance on benchmark datasets does not necessarily guarantee effective deployment in operational environments. Key challenges include class imbalance, false-positive alarms, limited cross-dataset generalization, computational overhead, and the detection of rare or previously unseen attacks. This review emphasizes the need for transparent experimental reporting, cross-dataset evaluation, multiple performance metrics, and consideration of computational efficiency when assessing NIDS models. The findings provide a structured perspective for researchers and cybersecurity practitioners in selecting, evaluating, and developing more reliable machine learning-based intrusion detection systems.